@flusys/ng-auth 8.1.5 → 9.0.0

package/README.md

@@ -180,6 +180,17 @@ providers: [
 ]
 ```
 
+### Password policy
+
+Every page that **sets** a password (register, reset password, change password, admin user form) validates through `PasswordPolicyService`, which defaults to `DEFAULT_PASSWORD_VALIDATION` — the same rule as the backend `@IsStrongPassword()` (8–128 chars, uppercase, lowercase, number, special character). `AUTH_VALIDATION_CONFIG.password` is merged over those defaults, so set only what you want to change; keep it at least as strict as the backend or the API will reject what the form accepts. The login page only requires a non-empty password, so accounts created under an older policy can still sign in.
+
+```typescript
+readonly passwordPolicy = inject(PasswordPolicyService);
+readonly passwordError = computed(() => this.passwordPolicy.validate(this.model().password)); // translated message or null
+```
+
+Email fields (login, register) validate through `EmailPolicyService` the same way: it applies `AUTH_VALIDATION_CONFIG.email` (`pattern`, `messageKey`/`message`, `messageParam`) and returns a translated message or `null`.
+
 ## License
 
 MIT © FLUSYS